Browse Source

vulnerability in Swagger UI template generation

A Cross-Site Scripting (XSS) vulnerability was identified in the get_swagger_ui_html() function, which generates the Swagger UI documentation page (/docs)
pull/14567/head
jeferson cardoso 7 months ago
committed by GitHub
parent
commit
c61b570931
No known key found for this signature in database GPG Key ID: B5690EEEBB952194
  1. 85
      fastapi/openapi/docs.py

85
fastapi/openapi/docs.py

@ -110,12 +110,28 @@ def get_swagger_ui_html(
[FastAPI docs for Configure Swagger UI](https://fastapi.tiangolo.com/how-to/configure-swagger-ui/) [FastAPI docs for Configure Swagger UI](https://fastapi.tiangolo.com/how-to/configure-swagger-ui/)
and the [FastAPI docs for Custom Docs UI Static Assets (Self-Hosting)](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/). and the [FastAPI docs for Custom Docs UI Static Assets (Self-Hosting)](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/).
""" """
current_swagger_ui_parameters = swagger_ui_default_parameters.copy() swagger_config = {
"url": openapi_url,
"dom_id": "#swagger-ui",
"layout": "BaseLayout",
"deepLinking": True,
"showExtensions": True,
"showCommonExtensions": True,
"presets": [
"SwaggerUIBundle.presets.apis",
"SwaggerUIBundle.SwaggerUIStandalonePreset"
]
}
if swagger_ui_parameters: if swagger_ui_parameters:
current_swagger_ui_parameters.update(swagger_ui_parameters) swagger_config.update(swagger_ui_parameters)
html = f""" if oauth2_redirect_url:
<!DOCTYPE html> swagger_config["oauth2RedirectUrl"] = f"window.location.origin + '{oauth2_redirect_url}'"
config_json = json.dumps(swagger_config, default=str)
html = f'''<!DOCTYPE html>
<html> <html>
<head> <head>
<link type="text/css" rel="stylesheet" href="{swagger_css_url}"> <link type="text/css" rel="stylesheet" href="{swagger_css_url}">
@ -126,35 +142,19 @@ def get_swagger_ui_html(
<div id="swagger-ui"> <div id="swagger-ui">
</div> </div>
<script src="{swagger_js_url}"></script> <script src="{swagger_js_url}"></script>
<!-- `SwaggerUIBundle` is now available on the page -->
<script> <script>
const ui = SwaggerUIBundle({{ const ui = SwaggerUIBundle({config_json});'''
url: '{openapi_url}',
"""
for key, value in current_swagger_ui_parameters.items():
html += f"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\n"
if oauth2_redirect_url:
html += f"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',"
html += """
presets: [
SwaggerUIBundle.presets.apis,
SwaggerUIBundle.SwaggerUIStandalonePreset
],
})"""
if init_oauth: if init_oauth:
html += f""" init_oauth_json = json.dumps(init_oauth, default=str)
ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))}) html += f'''
""" ui.initOAuth({init_oauth_json});'''
html += """ html += '''
</script> </script>
</body> </body>
</html> </html>'''
"""
return HTMLResponse(html) return HTMLResponse(html)
@ -216,21 +216,21 @@ def get_redoc_html(
Read more about it in the Read more about it in the
[FastAPI docs for Custom Docs UI Static Assets (Self-Hosting)](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/). [FastAPI docs for Custom Docs UI Static Assets (Self-Hosting)](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/).
""" """
html = f"""
<!DOCTYPE html> html = f'''<!DOCTYPE html>
<html> <html>
<head> <head>
<title>{title}</title> <title>{title}</title>
<!-- needed for adaptive design --> <!-- needed for adaptive design -->
<meta charset="utf-8"/> <meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="viewport" content="width=device-width, initial-scale=1">
""" '''
if with_google_fonts: if with_google_fonts:
html += """ html += '''<link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet">
<link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet"> '''
"""
html += f""" html += f'''<link rel="shortcut icon" href="{redoc_favicon_url}">
<link rel="shortcut icon" href="{redoc_favicon_url}">
<!-- <!--
ReDoc doesn't change outer page styles ReDoc doesn't change outer page styles
--> -->
@ -248,8 +248,8 @@ def get_redoc_html(
<redoc spec-url="{openapi_url}"></redoc> <redoc spec-url="{openapi_url}"></redoc>
<script src="{redoc_js_url}"> </script> <script src="{redoc_js_url}"> </script>
</body> </body>
</html> </html>'''
"""
return HTMLResponse(html) return HTMLResponse(html)
@ -259,9 +259,8 @@ def get_swagger_ui_oauth2_redirect_html() -> HTMLResponse:
You normally don't need to use or change this. You normally don't need to use or change this.
""" """
# copied from https://github.com/swagger-api/swagger-ui/blob/v4.14.0/dist/oauth2-redirect.html
html = """ html_content = """<!doctype html>
<!doctype html>
<html lang="en-US"> <html lang="en-US">
<head> <head>
<title>Swagger UI: OAuth2 Redirect</title> <title>Swagger UI: OAuth2 Redirect</title>
@ -339,6 +338,6 @@ def get_swagger_ui_oauth2_redirect_html() -> HTMLResponse:
} }
</script> </script>
</body> </body>
</html> </html>"""
"""
return HTMLResponse(content=html) return HTMLResponse(content=html_content)

Loading…
Cancel
Save